Supplier onboarding and approval
Supplier onboarding is where two very different risks meet: paying a fraudster because bank details arrived in an email, and depending on a supplier nobody assessed. Both are prevented by the same discipline, which is verifying independently rather than trusting the document in front of you.
- 1
Requester submits the proposed supplier with what they will provide and why an existing approved supplier will not do.
Requester
The second half matters. Supplier lists grow through convenience, and every additional supplier is additional risk and admin.
- 2
Finance Lead verifies the supplier is a real legal entity using an independent public register, not documents the supplier provided.
Finance Lead
Independent source. A letterhead, a website, and a company number on an invoice can all be fabricated in an afternoon.
- 3
Finance Lead verifies bank details by telephoning a number obtained independently, never one from the invoice, email, or supplier's own paperwork.
Finance Lead
This single step prevents the most common and most expensive fraud in procurement. Urgency is the pressure tactic, so no exceptions for urgency.
Verified: go to step 4
Cannot verify: go to step 11
- 4
Finance Lead records who verified the bank details, how, and on what date.
Finance Lead
The record is the control. "We checked" with no name or date is indistinguishable from not checking.
- 5
Category Owner assesses whether this supplier would be critical: a single source, holding customer data, or on the critical path for delivery.
Category Owner
Not critical: go to step 7
Critical: go to step 6
- 6
Category Owner completes enhanced due diligence for a critical supplier: financial stability, insurance, business continuity, and any required certifications.
Category Owner
For a single-source critical supplier, financial stability is the check that matters most. A supplier failing takes your delivery with it.
Passed: go to step 7
Failed: go to step 11
- 7
Finance Lead confirms whether the supplier will process customer or personal data on your behalf.
Finance Lead
No personal data: go to step 9
Will process personal data: go to step 8
- 8
Finance Lead ensures a data processing agreement is in place before any data is shared, and records where it is held.
Finance Lead
Before data is shared, not after go-live. Retrofitting a processing agreement to a supplier already holding your customers' data is a disclosure waiting to happen.
Agreement in place: go to step 9
Supplier will not sign: go to step 11
- 9
Category Owner records the agreed commercial terms, payment terms, and any service expectations.
Category Owner
Written terms, so the invoice-approval control downstream has something to check against.
- 10
Finance Lead adds the supplier to the approved list with its category, owner, and next review date.
Finance Lead
An owner and a review date, or the approved list becomes a list of everyone you have ever paid.
Approved and recorded: the procedure ends
- 11
Finance Lead records the rejection with the reason and informs the Requester, and does not release payment.
Finance Lead
Record it. A rejected supplier reappearing under a slightly different name is exactly the pattern this catches.
Closed: the procedure ends
Change these before you use it
- Define what makes a supplier critical for you in step 5, concretely, or nothing will be classified as critical.
- Name the independent register you check in step 2 for your jurisdiction.
- Set the review cadence per supplier tier in step 10 rather than one interval for everyone.
- Confirm your data processing agreement requirements with whoever owns your privacy compliance. This template names no specific regime.
- Connect this to your invoice approval and purchase order procedures, since all three depend on the same approved-supplier record.
This is a starting point, not compliance advice. It is written to be adapted, and a procedure that touches access, money, or customer data needs to match how your business actually operates and whatever rules apply to you. Use it as a first draft to edit, not a policy to adopt.
Make it yours in a couple of minutes
Rather than retyping this and editing it, describe your own version of the process out loud or click through it once, and get a first draft with your actual steps, roles, and systems in it. No account needed to see the result.
No account neededNo credit cardSee the whole SOP before you sign up